It's a bit more complicated than that. However, you are conceptually correct in that these days battling DDOS attacks locally on host itself can be resource intensive and is largely a losing game overall. Even if initially successful, it's doomed to be at the least a hassle and usually an eventual failure because the attacks are always churning sources and methods.
This is why almost all modern websites place a DDOS service in front that has the insane bandwidth and dedicated detection and denial software to absorb/block the attack. Or another option, they use something like Anubis (which I believe is what Null forked for Kiwiflare) to make the client connecting initially do a CPU intensive task. XKeeper discussed on his blog reasons for not doing either of the above. Former was because Cloudflare supports fascism or something retarded like that and I don't remember the latter reason for no Anubis.
Basically the site has to suffer because of muh nazis.